MalwareUsed by 1 actor

PolyglotDuke

PolyglotDuke is a Windows first-stage implant and downloader associated with APT29, also known as the Dukes or Cozy Bear, and was used in the long-running espionage campaign known as Operation Ghost. It has been observed targeting high-value diplomatic and government entities, including European ministries of foreign affairs and an embassy in Washington, DC. The malware forms part of a staged intrusion platform in which it serves as an initial foothold and command-and-control discovery component before follow-on payloads are deployed.

PolyglotDuke is notable for its stealth-oriented command-and-control discovery methods. It can obtain command-and-control URLs from public web services including social media and image-hosting platforms, and it can use steganography to conceal command-and-control information within images. The malware also uses custom string decryption routines and stores encrypted JSON configuration data in the Windows Registry, reflecting an emphasis on obfuscation and low-visibility local storage.

Execution behavior includes use of Windows mechanisms such as rundll32 as well as API-driven loading and process creation through functions including LoadLibraryW and CreateProcess. These traits align with its role as a lightweight staging implant designed to retrieve and launch additional malicious components while minimizing overt artifacts. PolyglotDuke has also been linked through code and tradecraft similarities to earlier Dukes malware families, reinforcing its place within APT29’s long-running espionage toolset.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT29

This held true until recent months, when we uncovered three new malware families that we attribute to the Dukes – PolyglotDuke, RegDuke and FatDuke.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.

Execution

1 technique

T1106Native APIEvidence4

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Persistence

1 technique

T1112Modify RegistryEvidence8

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence7

The Dukes encrypts PolyglotDuke and LiteDuke payloads with custom algorithms. They also rely on known obfuscation techniques such as opaque predicates and control flow flattening to obfuscate RegDuke, MiniDuke and FatDuke.

T1027.003SteganographyEvidence1

T1027.011Fileless StorageEvidence2

Examples include: “ComRAT has encrypted and stored its orchestrator code in the Registry…”, “ShadowPad maintains a configuration block and virtual file system in the Registry.”, and “QakBot can store its configuration information…under HKCU\Software\Microsoft.”

T1140Deobfuscate/Decode Files or InformationEvidence8

APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

T1218.011Rundll32Evidence1

Defense Impairment

1 technique

T1112Modify RegistryEvidence8

Command and Control

7 techniques

T1001Data ObfuscationEvidence1

Command and Control T1001 Data Obfuscation The Dukes use steganography to hide payloads and commands inside valid images.

T1008Fallback ChannelsEvidence1

Command and Control T1008 Fallback Channels The Dukes have multiple C&C servers in case one of them is down.

T1071Application Layer ProtocolEvidence1

Command and Control T1071 Standard Application Layer Protocol The Dukes are using HTTP and HTTPS protocols to communicate with the C&C server.

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.

T1102Web ServiceEvidence2

PolyglotDuke fetches public webpages (Twitter, Reddit, Imgur, etc.) to get encrypted strings leading to new C&C server. For RegDuke, they also use Dropbox as a C&C server.

T1102.001Dead Drop ResolverEvidence1

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Impact

1 technique

T1565Data ManipulationEvidence1

ComRAT has modified Registry values to store encrypted orchestrator code and payloads ... QakBot can modify the Registry to store its configuration information ... Volgmer modifies the Registry to store an encoded configuration file ...

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

mitre attack websiteNews

Feb 1, 2022

APT29, IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm, Blue Kitsune, UNC3524, Midnight Blizzard, Group G0016 | MITRE ATT&CK®

APT29 malware strain used in Operation Ghost.

mitre attack websiteNews

Oct 21, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware that uses a custom algorithm to decrypt strings.

mitre attack websiteNews

Oct 21, 2021

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®

Malware that uses LoadLibraryW and CreateProcess to load and execute code.

mitre attack websiteNews

Oct 21, 2021

Modify Registry, Technique T1112 - Enterprise | MITRE ATT&CK®

Backdoor that writes encrypted JSON configuration data into the Registry.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

PolyglotDuke